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Untroduction 

Quantum properties of the physical systems may realize provably secure communication 
between two legitimate parties. The main task of the so-called quantum key distribution (QKD) 
protocols is to achieve secret-key sharing using imperfect semi classical signals and devices [1]. 
However, since the first demonstration of quantum teleportation using continuous variable (CV) 
[2], the QKD protocols based on quantum CV systems via coherent states have also been 
proposed recently for achieving the secret key sharing [3-7]. The main idea in CV QKD is that 
the legitimate receiver (Bob) of the transmitted signal measures one of the conjugate quadratures 
randomly; but an exception is found [7]. 

The security of the Gaussian CV-QKD protocol with the homodyne detection has been 
proven against individual Gaussian eavesdropping attacks, using either direct [3] or reverse [4] 
reconciliation. Moreover, the security proof of this protocol against general individual or finite- 
size attacks [7], and general collective attacks [9-11] has been verified. Also, the security of the 
Gaussian CV-QKD protocol with the heterodyne detection has been discussed in [12-15]. 
Precisely, the bounds of Eve's accessible information in the case of individual Gaussian attacks 
have been developed in [ 12], and later improved in [13, 14], while the case of collective attacks 
has been analyzed in [15]. Recently, the unconditional security of both the homodyne and the 
heterodyne protocols has been proven [16]. 

In spite of the CV QKD shows many advantages over the discrete variable QKD such as high 
key rate, it is still restricted to a small distance. So far it is experimentally demonstrated over 
30Km [11] and theoretically possible over 50Km [17]. The reason of this comes fi-om excess 
noise produced by the quantum channel and the difficulty of applying the error correction code 
[11,17]. 
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Working with high signal-to-noise ratio (SNR) needs a very good reconciliation, otherwise 
the secret key rate goes to zero [11, 17]. Unfortunately, even with the best codes available today 
(low-density parity check LDPC codes [18] or turbo codes [19]), still there is no hopes to extend 
the distance over 50 Km. On the other hand, working with low SNR may increases the range of 
the protocol [17]. Nonetheless, maintaining good reconciliation efficiency at very low SNR is 
even more difficult. There are some interesting algebraic properties of can be useful which 
may enhance the practical distance up to 50 km [17]. 

Recently, a new protocols using discrete modulation have been developed [20] and 
experimentally implemented [21]. These protocols are theoretically promising to achieve 
hundreds of Km and shows high tolerance against the excess noise generated by the quantum 
channel. Their property is that they always generate less than bit for each pulse and for any 
practical distance. This property makes them more suitable to work over the long distance. In 
fact many bits for each pulse can be achieved using the Gaussian modulation over short distance. 
After several kilometers the Gaussian modulation will generate less than bit for each pulse as 
well and the two modulations become comparable. The discrete modulation is more robust 
against the excess noise and can achieve longer distance while the Gaussian modulation key rate 
drops below zero after tens of kilometers. It is worth mentioning that an interesting new 
reconciliation algorithm has been developed for direct and reverse reconciliation [20] as well. 
This algorithm is promising to achieve more than 80% efficiency even with low SNR [20]. 

In this paper, we develop new protocol based on the eight coherent states (eight-state 
protocol). In this protocol Alice sends one of the eight coherent states \ae^^'^^^) with k G 
{0,1,2, ...,7} to Bob with equal probability. Bob will measure the received states either via 
homodyne or heterodyne detections. For this protocol we calculate the secret key rate of the 
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collective attacks. We consider the realistic case where the losses and excess noise of the quantum 
channels can be controlled by the eavesdropper Eve. We take into account also the imperfection 
of detection, and electronic noise (or thermal noise) generated by the homodyne (heterodyne) 
detection circuit. 

This paper is prepared in the following ordered. In section II, we introduce the protocol of 
CV-QKD using 8-state coherent discrete modulation. In sections III we review some notation 
and assumptions. In section IV, we derive corresponding expressions for the secret information 
rate in the presence of Eve collective attacks. The performance of the protocol in a realistic 
practical setup in fibre optics base is given in section V. The main results are summarized in 
section VI. 

II.Eight-State Protocol 

In this section we describe the eight-state protocol and give some mathematical justification 
which will be used in the rest of the paper. More illustratively, we develop the form of the 
state l^s)' which can be used in an entanglement-based version of the protocol. Also we 
deduce the covariance matrix for this state. 

The eight-state protocol can be described as follows. Alice sends one of the eight displaced 
coherent states = \a), 1^2) = \ae'''/% = lae'^/^), I)?!) = lae'^^/*), = lae''^), 

\-p2) = lae'S^/^), = |ae'37r/2^^ | _ ^ i^e'^^/*) with equal probability (, i.e. 1/8) 

to Bob. Information about the distribution of these eight states in the phase space is shown in 
figure 1. Bob chooses to measure one of the two quadratures randomly (homodyne case) or both 
quadratures simultaneously (heterodyne case). Once the quantum transmission phase of the 
communication has ended, Alice and Bob proceed with classical data processing procedures. 
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which include a reconciliation algorithm to extract an identical chain of bits from their correlated 
continuous data, and a standard privacy amplification process to derive a final secret key from 
this chain. The reconciliation is direct when Alice's data is used as a reference for establishing 
the key and reverse when the reference is Bob's data. Reverse reconciliation has been shown to 
offer a great advantage in QKD system performance [9], therefore calculations in this paper have 
been performed for this case. Direct reconciliation expressions can be derived using similar tools 
as the ones presented here. 

Now we give the mathematical treatment for |^g). In the first step, Bob receives a mixed 

state represented by the density matrix pg, which has the form: 

P8 = l<iWim + W2m\ + w*i){p*i\ + w*2m\+ i-a)<-ai+ i-PiK-PiI 

+ \-PD{-Pl\+ \-P2){-P2\l (1) 

= ^I0o)<0ol + ^il0i)<0il + - + (2) 

where 

Ao(4) = l^cosh(a^) + cos(a^) ± 2 cos cosh {^=j\ , 

^1(5) = ^e-"' [sinhCa^) + sinCa^) ± V2cos sinh ±^^2sm cosh (^^)], 
^2(6) = ^e""' [cosh(a2) - cos(a^) ± 2 sin sinh (^^)], 

. ^3(7) = ^e''^^ [sinhCa^) - sin(a^) + V2cos sinh ±V2sin cosh (^^)] 
and 

l<^'^> = k^n=oi^|8^ + ^>' for/cE{0,l,2 7}. (4) 

Applying the annihilation operator a to Icj)]^) gives: 



(3) 



a 10^) = , for G {1,2 7], and (5) 

a |0o) = 107)- (6) 



5 



Figure 1 : (Color online.) Encoding schemes used for the eight-state protocol 
Now we consider for the state pg the following purification 

l^8) = lLoV4l0/c)|0/c)- (V) 

This state can be rewritten as 

l^s) = l/4(\xp,)\p^) + \xp^)\-P2) + IM-PD + \rp3)\-P2) + 

+ \rpsm) + \MPD+\^7)\P2)l (8) 

where 
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1 V— 1 i(4k+l)mn 

\^k) = ^2_,^ 4 10^), for /ee {0,1,2 7}. (9) 

m=0 

It is evident that states (9) are orthogonal non-Gaussian states. The bipartite state (8) is a good 
example for the entanglement based scheme, in which Alice performs projective measurement 
on one of the set {|0o)(0ol' l0i)(0iM02)(02l' ■■■ I07)(07l } to the first half of l^g) and that she 
therefore projects the second half on one of the eight coherent states|)ffi) ,|)ff2).---5|~)5i) with 
equal probabilities . 

Now we are in the position to evaluate the covariance matrix Eg of the bipartite state I^Fg) . 
Using symmetry arguments Tq has the following form: 




with 

X = {^s\2a+a + l\'i's). 

Y ^{^>s\2b^b + l\^>s), (11) 
^Zs = {'¥s\ab + a+b+\Ws), 

where a, a^and b, b'^aie the annihilation and creation operators related to Alice and Bob modes, 
respectively. Therefore, the covariance matrix elements X, 7and Zq then read: 

X = Y = l + 2a^ = 1 + Va, and (12) 
Z8 = 2a^i:Lo^= VAn=o'-^ (13) 



We conclude this section by comparing the behavior of Zswith that of Zq of the Gaussian 

modulation protocol {Zq — VK^ — 1 with K = + 1 ) and Z4 of the four-state discrete 
modulation protocol [20]. Information about this is shown in figure 2. It is clear that for 
variance 7^ < 1, Zg and Zq are almost indistinguishable, meaning that in this regime, one has the 
Holevo bound58(5,£') ~ Sq(B,E). Therefore, the security bounds for the Gaussian modulation 
can be carried here as well. 
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Figure2: Comparison between the Correlations: Zq — Vl^^ — 1 (Gaussian 
modulation), Z4 (4-state discrete modulation) and Zg (8-state discrete 
modulation). 

III.Notations and assumptions 

In this section we describe the parameters of the eight-state protocol. These parameters will be 
used to study the collective attacks. In the execution of the protocol Alice and Bob use quantum 
channels and detectors (homodyne or heterodyne). We assume that the channel features 
transmission efficiency T and excess noise e. These parameters result in a noise variance at 
Bob's station as (1 + T £)Nq, where refers to shot-noise hmit. The total channel-added 
noise referred to the channel input, expressed in shot noise units, is defined as Xiine — l/T — 1 + 
£. Furthermore, we assume the detector in the Bob's station is characterized by the efficiency Vj 
(due to the losses) and a noise Sgie (due to the thermal noise introduced by the electrical circuit). 
The total added noise referred to the homodyne (heterodyne), expressed in shot-noise units, is 
defined as Xhom = iiX -Vi)+ ^eielh for homodyne and Xhet = [1 + (1 - ^) + '^^eieM'n for 
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heterodyne detection. Therefore, the total noise referred to the channel input can then be 

expressed Xt = Xune + Xhom (het)/T. 

We conclude this section by mentioning that the eight-state protocol is a prepare-and- 
measure scheme. This is based on the fact that Alice prepares and sends one of the eight 
displaced coherent states and Bob measures these station in his work station. In this respect, 
this protocol is equivalent to the entanglement-based scheme, which is shown in figure 3. 
Bob's detector inefficiency is modelled by a beam-splitter with transmission?/, while its 
electronic noise £eie is modelled by an EPR state of variance N, one half of which is 
entering the second input port of the beam-splitter, as shown in figure 3. The variance N is 
chosen to obtain an appropriate expression of Xhom (het)- For homodyne detection, 
N = r] Xhom/Ci- - V), and for heterodyne N = (rj Xhet - 1)/(1 - V)- 
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Figure 3: Entanglement -based scheme of 8-state discrete modulation CVQKD protocol with 
homodyne or heterodyne detection. The transmission T and channel-added noise Xune ^re 
controlled by Eve, who does not have access to Bob's detection apparatus. 
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rV.CoUective attacks: 

In this section, we use the resuhs in the preceding sections to discuss the collective attacks for 
the protocol under consideration. In the collective attacks, Eve interacts individually with each 
pulse. We assume that it is allowed for her to wait till the entire classical process to be ended 
before performing the collective measurement on her stored ancillae. In this attack, the 
maximum information accessible to Eve is limited by the Holevo bound Xbe [22]. In the reverse 
reconciliation and under the realistic case, the Holevo secret key rate is given by: 

l^l"°''''°>PlAB-XnE' (14) 

where P is the reconciliation algorithm efficiency and /^g is the mutual information between 
Alice and Bob that is given by [1 1, 23]: 

1 Vb 1 V + Xt 

Ub = ^ log - — = - log , (15) 

2 Vb/a 2 1 + 

where Vb/a is the conditional variance of Alice based on Bob measurement Vb/a = (-^b^) ~ 
{XaXb^HXa^) . Note that in the case of heterodyne detection the mutual information /^^ is 
double of the one in the expression (15). The Holevo bound Xbe is given by [9-11]: 

Xbe = S{pabJ - S{p'J,) = Y.U G (^) - G (^) , (16) 
^hQXQ G(jk) = (x + V)\og{x + V) — xXogx , Ai_2 are the symplectic eiegenvalues of the 
covariance matrix }Oibj^, and ^3 4 5 are the symplectic eiegenvalues of the covariance matrix y^p^ 
after Bob's projective measurement (see Fig. 3). 

The covariance matrix y^gi depends on the system including Alice and the channel, and it's 
given by: 



_ r Ya "^ABi] _ 
K4Bi-[c7^B^ 7b J ~ 



VI2 ^/fZsCTz 
VfZsO-^ T(y + Xline)h 



(17) 
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The symplectic eigenvalues A12 are then given by: 

>li,2 = J{A±VA^^4Dj,with (18) 

fA = det Yabi 

|d = det Ya + det Yb^ +2 det a^g^ ^^^^ 

The entropy 5(p^|g) is determined from the symplectic eigenvalues ^3,4,5 of the covariance 

matrix Yafg ^^^^^ Bob's projective measurement. The matrix Yafg written as: 

Yafg ~ Yafg ~ (^afgb^H (Jafgbi (20) 

where H stands for the symplectic matrix which represents the homodyne (heterodyne) 
measurement on mode B. In the former case 

Hhom = (X^rsX)^^, where Z = (J and MP 

stands for Moore-Penrose Pseudo-inverse of a matrix for homod5Tie and H/jet = (Jb + ^2)'^ for 
heterodyne detection. The matrices yg, Yafg <^afgb can be derived from the decomposition 
of the covariance matrix: 



Yafgb — 



T 

Yafg (^afgb 

(^AFGB Yb 



(21) 



The above matrix can be derived with appropriate rearrangement of rows and columns of the 
matrix describing the system Yabfg^ which is given by: 

Yafgb = (Y^'YiYAB, @ Yfog)Y'' (22) 
The matrix F^'^ describes the beamsplitter transformation that models the inefficiency of the 
detector, which acts on modes B^and Fq and it has the form: 

Y'' = l2@ YiX @ h (23) 
Now we can proceed to calculate the symplectic eigenvalues ^3,4,5 of the three-mode matrix (20). 
The symplectic eigenvalues A3 4 5 are given by 
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where for homodyne case [1 1] we have 



A 



hom ~ 



^Xhom+V^+T(y+Xline) 

nv+XT) 



(25) 



hom ~ 



T(y+XT) 



(26) 



For heterodyne case [14] we have 



A 



het ~ 



AXhom^+D+^+2Xhom[V^+T(y+Xline)+2TZ8\ 

tHv+xt)'' 



(27) 




y+^Xhet \^ 

■ nv+XT) ) 



(28) 



The parameters A and D are given by equations (19). Based on the equations (14), (18-19) and 
(24-28), we can calculate the Holevo bound and thus derive the Holevo secret information 
rate A/^°'^^° — PIab ~ Xbe- In the following section we investigate the performance of our 
eight-state protocol based on the discrete modulation in the realistic setup. 

V. Application to practical systems: 

In this section, we apply the result derived in sections 11 and IV to practical QKD system. 
Precisely, we calculate the secret key generation rate as a function of distance for fibre-optic 
implementations of CV-QKD protocol in the existence of collective eavesdropping attacks. This 
will be done for the homodyne and heterodyne detections. 

The numerical simulations of the secret information rate are shown in the figures 4 (a, /)) and 
5 (a, b) for the four-state and eight-state protocols, respectively. 
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In the numerical treatment, the channel transmission efficiency is given as 7 = lO"*^^/^", where 
[i = 0.2db/Km is the loss coefficient for the standard optical fibres, and L is the length of the 
fibre optics. In most practical CVQKD protocols, the efficiency of detection has the value 
T] = 0.6 (60%), the electrical noise introduced by the homod5aie detection circuits is Sgie = 
0.05 and the excess noise introduced by the channel (standard fibre optics) is £ = 0.005 (in shot- 
noise units) [11]. Here we assume that Eve intercepts the quantum channel and produces extra 
excess noise. Thus, we study the tolerance of our QKD protocol against different values of 
excess noise, in particular, we take a = 0.005 (in absence of Eve), e = 0.01 and e = 0.02 (in 
shot-noise unit). The reconciliation of algorithm is fixed io - 0.8 , which is the actual values 
for the homodyne detection protocols [20, 21]. 

It is worth pointing out that we have considered the same reconciliation efficiency for both 
configurations, i.e. homodyne and heterodyne detections. Therefore, both of them seem to 
generate same key rate. Nonetheless, in practice the heterod5Tie detection can give better 
reconciliation than that of the heterodyne detection. 
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Figure 4: Secret key rate of the 4-state protocol for realistic reconciliation efficiency of 80% and a 
quantum efficiency of Bob's detection equal to 0.6 with thermal noise £gjg = 0.05 (in shot-noise 
unit).V^ = 1. (a) for homodyne and (b) for heterodyne. 
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Figure 5: Secret key rate of the eight-state protocol for realistic reconciliation efficiency of 80% 
and a quantum efficiency of Bob's detection equal to 0.6 with thermal noise £g;g = 0.05 (in shot- 
noise unit). = 1. (a) for homodyne and (b) for heterodyne. 
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The comparison between Figs. 4 and 5 leads to that the eight-state protocol performance is 
much better than the four-state protocol. More illustratively, it distributes the secret keys over 
longer distances, offers higher key rate and tolerates much excess noise. The tolerance of excess 
noise is extremely important since the excess noise is not always fixed to £ = 0.005 (in shot- 
noise unit), but it can vary from one experiment to other one. From figures 5, it is obvious that 
the eight-state protocol can distribute positive key over 100 Km even in the presence of high 
excess noise. Thus, this protocol is extremely promising to gain hundreds of Kilometers in fiber 
optics base with current equipments as well as the reconciliation algorithm introduced in [20]. 

Conclusion 

In this paper, we have developed the eight-state protocol. We have studied the security of the 
protocol against the collective attacks taken into account the realistic lossy, noisy quantum 
channels, imperfect detector efficiency, and detector electronic noise. The protocol shows high 
tolerance against excess noise and can achieve hundreds of kilometers distance long in optical 
fiber base with the current technology. 
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